[ Regional requirements ]

SMB1001 and email authentication: verify applicable controls and evidence

SMB1001 is a cyber security certification for small and medium businesses, and email authentication sits inside its controls for protecting your domain and your customers. In practice that means publishing SPF and DKIM for every service that sends as you, and a DMARC (RFC 9989) policy that tells receivers what to do with mail that fails, with reports flowing back so you can prove it works.

Which controls apply depends on the certification level you are aiming for, so the first step is matching each requirement to evidence you already have. The EmailAuth AI Agent reads your domain's live DNS, shows which records are in place and which are missing, and helps you build a clear evidence trail for your assessor. Start with your domain below, or book a free call with an EmailAuth engineer.

To get specific help for SMB1001 and email authentication, engage with our EmailAuth AI Agent. It reads your domain's live DNS, checks what is already in place, and gives you ready-to-paste records or walks you through each step.

Open the EmailAuth AI Agent

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Regional requirements and research